Comment by echelon
18 hours ago
Replace it all with Rust. It's a fantastic server language.
Nobody needs to write any of this code anymore.
Rust is literally the best positioned language to handle the upcoming onslaught of CVEs.
18 hours ago
Replace it all with Rust. It's a fantastic server language.
Nobody needs to write any of this code anymore.
Rust is literally the best positioned language to handle the upcoming onslaught of CVEs.
> Rust is literally the best positioned language to handle the upcoming onslaught of CVEs.
Rust is also a language with no real stdlib, and so you have to import crates for everything including the kitchen sink.
Which opens you up to the very real risk of supply chain vulnerabilities unless you make an active effort to code review your imports and keep the length of your import list under control.[1][2][3]
Rust supporters also need to urgently realise that memory safe != secure. It is very much possible to have vulnerabilities in memory safe code.
This has been demonstrated by Cloudflare[4] and countless others.
Age-old vulnerability classes such as input validation, error handling and many others are still very much possible in a Rust codebase.
So please. Yes, I'm sure Rust is a fantastic memory-safe language. But do not portray it as being magically immune from CVEs.
[1] https://kerkour.com/rust-supply-chain-nightmare
[2] https://tweedegolf.nl/en/blog/119/sudo-rs-depencencies-when-...
[3] https://tweedegolf.nl/en/blog/104/dealing-with-dependencies-...
[4] https://hackaday.com/2025/11/20/how-one-uncaught-rust-except...
If you "really" want to secure the web you reduce the blast radius - there's absolutely no reason that most websites (99% static) are served live from CGI_BIN.
Well-architected solutions would have the static part broken out so only the dynamic content is on a separate domain/host and that part can be secured as needed. Then something like this only turns off your forms/upload dialogs.
Other vulnerabilities are possible, but still much easier to rule out in a language with a decent type system and macros (e.g. Rust or Scala).
No real stdlib? What are you talking about?
Not who you’re replying to, but Rust lacks things I assumed were basics in any modern language, like random number generation, JSON handling, and regex. I understood the reasoning once I looked into why, but it was still startling at first.
In contrast (I know this is apples to oranges), Python’s stdlib is incredibly broad. colorsys lets you convert between color spaces. plistlib lets you read and write Apple’s property list files. graphlib has a topological sorter, which can lead to hilariously short interview questions when the interviewer isn’t familiar with Python’s stdlib.
> No real stdlib? What are you talking about?
I'm not rising to that bait. I'm sure you know perfectly well what I mean.
So let's just be polite, cordial and leave that topic there there. I'm sure you know its a topic that attracts 'strong views', particularly from the Rust side, which is no doubt why you're trying to engage on it.
2 replies →